3ed0426d82cc43291d65ba3aa78229c82923c8cf582bc041145f8c6e0155cba3 | Triage

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-12-2024 18:48

Sharing

Report Analysis Logs

General

Target

source_prepared.exe
Size

107.6MB
MD5

8c00d684edf8f8f89d7a4eb401580941
SHA1

8d0e17aea7949653a62ab4b9845f624cad80e278
SHA256

6d631edeb4b7dbd0e5ef2f757f87b15c59a8d356f580a71ba041c103da4f9e6f
SHA512

4c1bcb357e6a1d09c333919b78c42ffb912e3f808580c5af61cd302127a52ac40422d894cffb4611b814dab2e38ec3ef3b59630d97c5c4ccd86e8c5c4ba7e867
SSDEEP

3145728:SUaeCRRS6xjKcBa6/2qHO5ifpBnG0iWMstB2OxQbyMjV:JaJjSWNa6NHCiRhieBK

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1844	source_prepared.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2524 wrote to memory of 1844	2524	source_prepared.exe	31
PID 2524 wrote to memory of 1844	2524	source_prepared.exe	31
PID 2524 wrote to memory of 1844	2524	source_prepared.exe	31

C:\Users\Admin\AppData\Local\Temp\source_prepared.exe
"C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2524
- C:\Users\Admin\AppData\Local\Temp\source_prepared.exe
  "C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"
  2⤵
  - Loads dropped DLL
  PID:1844

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI25242\python311.dll

Filesize
5.5MB

MD5
387bb2c1e40bde1517f06b46313766be

SHA1
601f83ef61c7699652dec17edd5a45d6c20786c4

SHA256
0817a2a657a24c0d5fbb60df56960f42fc66b3039d522ec952dab83e2d869364

SHA512
521cde6eaa5d4a2e0ef6bbfdea50b00750ae022c1c7bd66b20654c035552b49c9d2fac18ef503bbd136a7a307bdeb97f759d45c25228a0bf0c37739b6e897bad

Download Submit